The Lawletter Vol 36, No 5
Charlene Hicks, Senior Attorney, National Legal Research Group
Professional medical employees are subject to such a wide variety of laws and regulations that it has become increasingly difficult for such professionals to both treat patients effectively and navigate through the legal maze. With the passage of time, the problem seems to be deepening. In 2009, California adopted an unprecedented program of medical privacy oversight by enacting laws that increase the financial penalties for a medical professional's unauthorized access of a patient's medical records. This legislation was a direct response to a series of high-profile privacy breach cases at UCLA Medical Center. In anticipation of the strong likelihood that the new state laws would conflict with existing federal laws, the State also established a new agency, the California Office of Health Information Integrity ("CalOHII"), to oversee the State's new medical privacy program.
Studies showed that in 2009, the first year California's new medical privacy laws were in effect, a total of 2,490 breaches were reported to the Department of Public Health. That Department, in turn, referred approximately 320 individuals to CalOHII for investigation. To date, CalOHII has demonstrated a willingness to investigate and fine medical professionals who did not actively intend to breach the law: Instead of interpreting the State's medical privacy laws as requiring a medical professional's specific knowledge that his or her action constituting the offense violates state law, CalOHII has interpreted the laws as requiring only the professional's knowledge that he or she performed the action.
To avoid federal preemption problems, CalOHII is in the process of completing preemption analyses of every California medical privacy statute. If the agency determines that a specific state law concerning personal medical information is preempted, that state law shall not be applicable to the extent of the preemption. Cal. Health & Safety Code § 130311.5(b). However, the extent to which a medical professional may view a patient's private medical information in contexts that do not directly relate to the treatment of that patient (such as administrative or even whistle-blowing activities) under the State's new legal scheme is unclear.
Where personal (medical) privacy interests clash with medical professionals' performance and workplace rights, the current trend is for legislators to favor the individual's privacy interests. Whether and to what extent this action may impede the future advancement of the medical field and/or infringe upon the employment rights of medical professionals remains to be seen.
